I work in info sec. The emphasis is never on securing things but rather on "risk management" the entire field of information security from a business perspectiv

I work in info sec. The emphasis is never on securing things but rather on "risk management" the entire field of information security from a business perspective is the quote from fight club "A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." That is literally what the entire field exists for. Here's the kicker the cost of X is so monumentally low right now because there are no consequences for it other than firing your CSO (Chief Sacrificial Officer) that there is almost never a reason to issue the recall.